$CONFIG = '{"lang":"en","error_reporting":false,"show_hidden":false,"hide_Cols":false,"calc_folder":false,"theme":"light"}';

define('VERSION', '2.4.6');

define('APP_TITLE', 'ABC Manager');

$use_auth = false;

$auth_users = array(

'admin' => '$2y$10$/K.hjNr84lLNDt8fTXjoI.DBp6PpeyoJ.mGwrrLuCZfAwfSAGqhOW', //admin@123

'user' => '$2y$10$Fg6Dz8oH9fPoZ2jJan5tZuv6Z4Kp7avtQ9bDfrdRntXtPeiMAZyGO' //12345

);

$readonly_users = array(

'user'

);

$use_highlightjs = true;

$highlightjs_style = 'vs';

$edit_files = true;

$default_timezone = 'Etc/UTC'; // UTC

$root_path = $_SERVER['DOCUMENT_ROOT'];

$root_url = '';

$http_host = $_SERVER['HTTP_HOST'];

$directories_users = array();

$iconv_input_encoding = 'UTF-8';

$datetime_format = 'd.m.y H:i';

$allowed_file_extensions = '';

$allowed_upload_extensions = '';

$favicon_path = '';

$exclude_items = array();

$online_viewer = 'google';

$sticky_navbar = true;

$max_upload_size_bytes = 5000;

$ip_ruleset = 'OFF';

$ip_silent = true;

$ip_whitelist = array(

'127.0.0.1', // local ipv4

'::1' // local ipv6

);

$ip_blacklist = array(

'0.0.0.0', // non-routable meta ipv4

'::' // non-routable meta ipv6

);

$config_file = __DIR__.'/config.php';

if (is_readable($config_file)) {

@include($config_file);

}

define('MAX_UPLOAD_SIZE', $max_upload_size_bytes);

if ( !defined( 'FM_SESSION_ID')) {

define('FM_SESSION_ID', 'filemanager');

}

$cfg = new FM_Config();

$lang = isset($cfg->data['lang']) ? $cfg->data['lang'] : 'en';

$show_hidden_files = isset($cfg->data['show_hidden']) ? $cfg->data['show_hidden'] : true;

$report_errors = isset($cfg->data['error_reporting']) ? $cfg->data['error_reporting'] : true;

$hide_Cols = isset($cfg->data['hide_Cols']) ? $cfg->data['hide_Cols'] : true;

$calc_folder = isset($cfg->data['calc_folder']) ? $cfg->data['calc_folder'] : true;

$theme = isset($cfg->data['theme']) ? $cfg->data['theme'] : 'light';

define('FM_THEME', $theme);

$lang_list = array(

'en' => 'English'

);

if ($report_errors == true) {

@ini_set('error_reporting', E_ALL);

@ini_set('display_errors', 1);

} else {

@ini_set('error_reporting', E_ALL);

@ini_set('display_errors', 0);

}

if (defined('FM_EMBED')) {

$use_auth = false;

$sticky_navbar = false;

} else {

@set_time_limit(600);

date_default_timezone_set($default_timezone);

ini_set('default_charset', 'UTF-8');

if (version_compare(PHP_VERSION, '5.6.0', '<') && function_exists('mb_internal_encoding')) {

mb_internal_encoding('UTF-8');

}

if (function_exists('mb_regex_encoding')) {

mb_regex_encoding('UTF-8');

}

session_cache_limiter('');

session_name(FM_SESSION_ID );

function session_error_handling_function($code, $msg, $file, $line) {

}

set_error_handler('session_error_handling_function');

session_start();

restore_error_handler();

}

if (empty($auth_users)) {

$use_auth = false;

}

$is_https = isset($_SERVER['HTTPS']) && ($_SERVER['HTTPS'] == 'on' || $_SERVER['HTTPS'] == 1)

|| isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https';

if (isset($_SESSION[FM_SESSION_ID]['logged']) && !empty($directories_users[$_SESSION[FM_SESSION_ID]['logged']])) {

$wd = fm_clean_path(dirname($_SERVER['PHP_SELF']));

$root_url = $root_url.$wd.DIRECTORY_SEPARATOR.$directories_users[$_SESSION[FM_SESSION_ID]['logged']];

}

$root_url = fm_clean_path($root_url);

defined('FM_ROOT_URL') || define('FM_ROOT_URL', ($is_https ? 'https' : 'http') . '://' . $http_host . (!empty($root_url) ? '/' . $root_url : ''));

defined('FM_SELF_URL') || define('FM_SELF_URL', ($is_https ? 'https' : 'http') . '://' . $http_host . $_SERVER['PHP_SELF']);

if (isset($_GET['logout'])) {

unset($_SESSION[FM_SESSION_ID]['logged']);

fm_redirect(FM_SELF_URL);

}

if($ip_ruleset != 'OFF'){

$clientIp = $_SERVER['REMOTE_ADDR'];

$proceed = false;

$whitelisted = in_array($clientIp, $ip_whitelist);

$blacklisted = in_array($clientIp, $ip_blacklist);

if($ip_ruleset == 'AND'){

if($whitelisted == true && $blacklisted == false){

$proceed = true;

}

} else

if($ip_ruleset == 'OR'){

if($whitelisted == true || $blacklisted == false){

$proceed = true;

}

}

if($proceed == false){

trigger_error('User connection denied from: ' . $clientIp, E_USER_WARNING);

if($ip_silent == false){

fm_set_msg(lng('Access denied. IP restriction applicable'), 'error');

fm_show_header_login();

fm_show_message();

}

exit();

}

}

if ($use_auth) {

if (isset($_SESSION[FM_SESSION_ID]['logged'], $auth_users[$_SESSION[FM_SESSION_ID]['logged']])) {

// Logged

} elseif (isset($_POST['fm_usr'], $_POST['fm_pwd'])) {

// Logging In

sleep(1);

if(function_exists('password_verify')) {

if (isset($auth_users[$_POST['fm_usr']]) && isset($_POST['fm_pwd']) && password_verify($_POST['fm_pwd'], $auth_users[$_POST['fm_usr']])) {

$_SESSION[FM_SESSION_ID]['logged'] = $_POST['fm_usr'];

fm_set_msg(lng('You are logged in'));

fm_redirect(FM_SELF_URL . '?p=');

} else {

unset($_SESSION[FM_SESSION_ID]['logged']);

fm_set_msg(lng('Login failed. Invalid username or password'), 'error');

fm_redirect(FM_SELF_URL);

}

} else {

fm_set_msg(lng('password_hash not supported, Upgrade PHP version'), 'error');;

}

} else {

// Form

unset($_SESSION[FM_SESSION_ID]['logged']);

fm_show_header_login();

?>

<section class="h-100">

<div class="container h-100">

<div class="row justify-content-md-center h-100">

<div class="card-wrapper">

<div class="card fat <?php echo fm_get_theme(); ?>">

<div class="card-body">

<form class="form-signin" action="" method="post" autocomplete="off">

<div class="form-group">

<div class="brand">

<svg version="1.0" xmlns="http://www.w3.org/2000/svg" M1008 width="100%" height="80px" viewBox="0 0 238.000000 140.000000" aria-label="ABC">

<g transform="translate(0.000000,140.000000) scale(0.100000,-0.100000)" fill="#000000" stroke="none">

<path d="M160 700 l0 -600 110 0 110 0 0 260 0 260 70 0 70 0 0 -260 0 -260 110 0 110 0 0 600 0 600 -110 0 -110 0 0 -260 0 -260 -70 0 -70 0 0 260 0 260 -110 0 -110 0 0 -600z"/>

<path fill="#003500" d="M1008 1227 l-108 -72 0 -117 0 -118 110 0 110 0 0 110 0 110 70 0 70 0 0 -180 0 -180 -125 0 c-69 0 -125 -3 -125 -6 0 -3 23 -39 52 -80 l52 -74 73 0 73 0 0 -185 0 -185 -70 0 -70 0 0 115 0 115 -110 0 -110 0 0 -190 0 -190 181 0 181 0 109 73 108 72 1 181 0 181 -69 48 -68 49 68 50 69 49 0 249 0 248 -182 -1 -183 0 -107 -72z"/>

<path d="M1640 700 l0 -600 110 0 110 0 0 208 0 208 35 34 35 34 35 -34 35 -34 0 -208 0 -208 110 0 110 0 0 212 0 213 -87 87 -88 88 88 88 87 87 0 213 0 212 -110 0 -110 0 0 -208 0 -208 -70 -69 -70 -69 0 277 0 277 -110 0 -110 0 0 -600z"/></g>

</svg>

</div>

<div class="text-center">

<h1 class="card-title"><?php echo APP_TITLE; ?></h1>

</div>

</div>

<hr />

<div class="form-group">

<label for="fm_usr"><?php echo lng('Username'); ?></label>

<input type="text" class="form-control" id="fm_usr" name="fm_usr" required autofocus>

</div>

<div class="form-group">

<label for="fm_pwd"><?php echo lng('Password'); ?></label>

<input type="password" class="form-control" id="fm_pwd" name="fm_pwd" required>

</div>

<div class="form-group">

<?php fm_show_message(); ?>

</div>

<div class="form-group">

<button type="submit" class="btn btn-success btn-block mt-4" role="button">

<?php echo lng('Login'); ?>

</button>

</div>

</form>

</div>

</div>

<div class="footer text-center">

&mdash;&mdash; &copy;

<a href="https://tinyfilemanager.github.io/" target="_blank" class="text-muted" data-version="<?php echo VERSION; ?>">CCP Programmers</a> &mdash;&mdash;

</div>

</div>

</div>

</div>

</section>

<?php

fm_show_footer_login();

exit;

}

}

if ($use_auth && isset($_SESSION[FM_SESSION_ID]['logged'])) {

$root_path = isset($directories_users[$_SESSION[FM_SESSION_ID]['logged']]) ? $directories_users[$_SESSION[FM_SESSION_ID]['logged']] : $root_path;

}

$root_path = rtrim($root_path, '\\/');

$root_path = str_replace('\\', '/', $root_path);

if (!@is_dir($root_path)) {

echo "<h1>".lng('Root path')." \"{$root_path}\" ".lng('not found!')." </h1>";

exit;

}

defined('FM_SHOW_HIDDEN') || define('FM_SHOW_HIDDEN', $show_hidden_files);

defined('FM_ROOT_PATH') || define('FM_ROOT_PATH', $root_path);

defined('FM_LANG') || define('FM_LANG', $lang);

defined('FM_FILE_EXTENSION') || define('FM_FILE_EXTENSION', $allowed_file_extensions);

defined('FM_UPLOAD_EXTENSION') || define('FM_UPLOAD_EXTENSION', $allowed_upload_extensions);

defined('FM_EXCLUDE_ITEMS') || define('FM_EXCLUDE_ITEMS', (version_compare(PHP_VERSION, '7.0.0', '<') ? serialize($exclude_items) : $exclude_items));

defined('FM_DOC_VIEWER') || define('FM_DOC_VIEWER', $online_viewer);

define('FM_READONLY', $use_auth && !empty($readonly_users) && isset($_SESSION[FM_SESSION_ID]['logged']) && in_array($_SESSION[FM_SESSION_ID]['logged'], $readonly_users));

define('FM_IS_WIN', DIRECTORY_SEPARATOR == '\\');

if (!isset($_GET['p']) && empty($_FILES)) {

fm_redirect(FM_SELF_URL . '?p=');

}

$p = isset($_GET['p']) ? $_GET['p'] : (isset($_POST['p']) ? $_POST['p'] : '');

$p = fm_clean_path($p);

$input = file_get_contents('php://input');

$_POST = (strpos($input, 'ajax') != FALSE && strpos($input, 'save') != FALSE) ? json_decode($input, true) : $_POST;

define('FM_PATH', $p);

define('FM_USE_AUTH', $use_auth);

define('FM_EDIT_FILE', $edit_files);

defined('FM_ICONV_INPUT_ENC') || define('FM_ICONV_INPUT_ENC', $iconv_input_encoding);

defined('FM_USE_HIGHLIGHTJS') || define('FM_USE_HIGHLIGHTJS', $use_highlightjs);

defined('FM_HIGHLIGHTJS_STYLE') || define('FM_HIGHLIGHTJS_STYLE', $highlightjs_style);

defined('FM_DATETIME_FORMAT') || define('FM_DATETIME_FORMAT', $datetime_format);

unset($p, $use_auth, $iconv_input_encoding, $use_highlightjs, $highlightjs_style);

if (isset($_POST['ajax']) && !FM_READONLY) {

// save

if (isset($_POST['type']) && $_POST['type'] == "save") {

// get current path

$path = FM_ROOT_PATH;

if (FM_PATH != '') {

$path .= '/' . FM_PATH;

}

// check path

if (!is_dir($path)) {

fm_redirect(FM_SELF_URL . '?p=');

}

$file = $_GET['edit'];

$file = fm_clean_path($file);

$file = str_replace('/', '', $file);

if ($file == '' || !is_file($path . '/' . $file)) {

fm_set_msg(lng('File not found'), 'error');

fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH));

}

header('X-XSS-Protection:0');

$file_path = $path . '/' . $file;

$writedata = $_POST['content'];

$fd = fopen($file_path, "w");

$write_results = @fwrite($fd, $writedata);

fclose($fd);

if ($write_results === false){

header("HTTP/1.1 500 Internal Server Error");

die("Could Not Write File! - Check Permissions / Ownership");

}

die(true);

}

//search : get list of files from the current folder

if(isset($_POST['type']) && $_POST['type']=="search") {

$dir = FM_ROOT_PATH;

$response = scan(fm_clean_path($_POST['path']), $_POST['content']);

echo json_encode($response);

exit();

}

// backup files

if (isset($_POST['type']) && $_POST['type'] == "backup" && !empty($_POST['file'])) {

$fileName = $_POST['file'];

$fullPath = FM_ROOT_PATH . '/';

if (!empty($_POST['path'])) {

$relativeDirPath = fm_clean_path($_POST['path']);

$fullPath .= "{$relativeDirPath}/";

}

$date = date("dMy-His");

$newFileName = "{$fileName}-{$date}.bak";

$fullyQualifiedFileName = $fullPath . $fileName;

try {

if (!file_exists($fullyQualifiedFileName)) {

throw new Exception("File {$fileName} not found");

}

if (copy($fullyQualifiedFileName, $fullPath . $newFileName)) {

echo "Backup {$newFileName} created";

} else {

throw new Exception("Could not copy file {$fileName}");

}

} catch (Exception $e) {

echo $e->getMessage();

}

}

// Save Config

if (isset($_POST['type']) && $_POST['type'] == "settings") {

global $cfg, $lang, $report_errors, $show_hidden_files, $lang_list, $hide_Cols, $calc_folder, $theme;

$newLng = $_POST['js-language'];

fm_get_translations([]);

if (!array_key_exists($newLng, $lang_list)) {

$newLng = 'en';

}

$erp = isset($_POST['js-error-report']) && $_POST['js-error-report'] == "true" ? true : false;

$shf = isset($_POST['js-show-hidden']) && $_POST['js-show-hidden'] == "true" ? true : false;

$hco = isset($_POST['js-hide-cols']) && $_POST['js-hide-cols'] == "true" ? true : false;

$caf = isset($_POST['js-calc-folder']) && $_POST['js-calc-folder'] == "true" ? true : false;

$te3 = $_POST['js-theme-3'];

if ($cfg->data['lang'] != $newLng) {

$cfg->data['lang'] = $newLng;

$lang = $newLng;

}

if ($cfg->data['error_reporting'] != $erp) {

$cfg->data['error_reporting'] = $erp;

$report_errors = $erp;

}

if ($cfg->data['show_hidden'] != $shf) {

$cfg->data['show_hidden'] = $shf;

$show_hidden_files = $shf;

}

if ($cfg->data['show_hidden'] != $shf) {

$cfg->data['show_hidden'] = $shf;

$show_hidden_files = $shf;

}

if ($cfg->data['hide_Cols'] != $hco) {

$cfg->data['hide_Cols'] = $hco;

$hide_Cols = $hco;

}

if ($cfg->data['calc_folder'] != $caf) {

$cfg->data['calc_folder'] = $caf;

$calc_folder = $caf;

}

if ($cfg->data['theme'] != $te3) {

$cfg->data['theme'] = $te3;

$theme = $te3;

}

$cfg->save();

echo true;

}

// new password hash

if (isset($_POST['type']) && $_POST['type'] == "pwdhash") {

$res = isset($_POST['inputPassword2']) && !empty($_POST['inputPassword2']) ? password_hash($_POST['inputPassword2'], PASSWORD_DEFAULT) : '';

echo $res;

}

//upload using url

if(isset($_POST['type']) && $_POST['type'] == "upload" && !empty($_REQUEST["uploadurl"])) {

$path = FM_ROOT_PATH;

if (FM_PATH != '') {

$path .= '/' . FM_PATH;

}

function event_callback ($message) {

global $callback;

echo json_encode($message);

}

function get_file_path () {

global $path, $fileinfo, $temp_file;

return $path."/".basename($fileinfo->name);

}

$url = !empty($_REQUEST["uploadurl"]) && preg_match("|^http(s)?://.+$|", stripslashes($_REQUEST["uploadurl"])) ? stripslashes($_REQUEST["uploadurl"]) : null;

//prevent 127.* domain and known ports

$domain = parse_url($url, PHP_URL_HOST);

$port = parse_url($url, PHP_URL_PORT);

$knownPorts = [22, 23, 25, 3306];

if (preg_match("/^localhost$|^127(?:\.[0-9]+){0,2}\.[0-9]+$|^(?:0*\:)*?:?0*1$/i", $domain) || in_array($port, $knownPorts)) {

$err = array("message" => "URL is not allowed");

event_callback(array("fail" => $err));

exit();

}

$use_curl = false;

$temp_file = tempnam(sys_get_temp_dir(), "upload-");

$fileinfo = new stdClass();

$fileinfo->name = trim(basename($url), ".\x00..\x20");

$allowed = (FM_UPLOAD_EXTENSION) ? explode(',', FM_UPLOAD_EXTENSION) : false;

$ext = strtolower(pathinfo($fileinfo->name, PATHINFO_EXTENSION));

$isFileAllowed = ($allowed) ? in_array($ext, $allowed) : true;

$err = false;

if(!$isFileAllowed) {

$err = array("message" => "File extension is not allowed");

event_callback(array("fail" => $err));

exit();

}

if (!$url) {

$success = false;

} else if ($use_curl) {

@$fp = fopen($temp_file, "w");

@$ch = curl_init($url);

curl_setopt($ch, CURLOPT_NOPROGRESS, false );

curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

curl_setopt($ch, CURLOPT_FILE, $fp);

@$success = curl_exec($ch);

$curl_info = curl_getinfo($ch);

if (!$success) {

$err = array("message" => curl_error($ch));

}

@curl_close($ch);

fclose($fp);

$fileinfo->size = $curl_info["size_download"];

$fileinfo->type = $curl_info["content_type"];

} else {

$ctx = stream_context_create();

@$success = copy($url, $temp_file, $ctx);

if (!$success) {

$err = error_get_last();

}

}

if ($success) {

$success = rename($temp_file, get_file_path());

}

if ($success) {

event_callback(array("done" => $fileinfo));

} else {

unlink($temp_file);

if (!$err) {

$err = array("message" => "Invalid url parameter");

}

event_callback(array("fail" => $err));

}

}

exit();

}

if (isset($_GET['del']) && !FM_READONLY) {

$del = str_replace( '/', '', fm_clean_path( $_GET['del'] ) );

if ($del != '' && $del != '..' && $del != '.') {

$path = FM_ROOT_PATH;

if (FM_PATH != '') {

$path .= '/' . FM_PATH;

}

$is_dir = is_dir($path . '/' . $del);

if (fm_rdelete($path . '/' . $del)) {

$msg = $is_dir ? lng('Folder').' <b>%s</b> '.lng('Deleted') : lng('File').' <b>%s</b> '.lng('Deleted');

fm_set_msg(sprintf($msg, fm_enc($del)));

} else {

$msg = $is_dir ? lng('Folder').' <b>%s</b> '.lng('not deleted') : lng('File').' <b>%s</b> '.lng('not deleted');

fm_set_msg(sprintf($msg, fm_enc($del)), 'error');

}

} else {

fm_set_msg(lng('Invalid file or folder name'), 'error');

}

fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH));

}

if (isset($_GET['new']) && isset($_GET['type']) && !FM_READONLY) {

$type = $_GET['type'];

$new = str_replace( '/', '', fm_clean_path( strip_tags( $_GET['new'] ) ) );

if (fm_isvalid_filename($new) && $new != '' && $new != '..' && $new != '.') {

$path = FM_ROOT_PATH;

if (FM_PATH != '') {

$path .= '/' . FM_PATH;

}

if ($_GET['type'] == "file") {

if (!file_exists($path . '/' . $new)) {

if(fm_is_valid_ext($new)) {

@fopen($path . '/' . $new, 'w') or die('Cannot open file: ' . $new);

fm_set_msg(sprintf(lng('File').' <b>%s</b> '.lng('Created'), fm_enc($new)));

} else {

fm_set_msg(lng('File extension is not allowed'), 'error');

}

} else {

fm_set_msg(sprintf(lng('File').' <b>%s</b> '.lng('already exists'), fm_enc($new)), 'alert');

}

} else {

if (fm_mkdir($path . '/' . $new, false) === true) {

fm_set_msg(sprintf(lng('Folder').' <b>%s</b> '.lng('Created'), $new));

} elseif (fm_mkdir($path . '/' . $new, false) === $path . '/' . $new) {

fm_set_msg(sprintf(lng('Folder').' <b>%s</b> '.lng('already exists'), fm_enc($new)), 'alert');

} else {

fm_set_msg(sprintf(lng('Folder').' <b>%s</b> '.lng('not created'), fm_enc($new)), 'error');

}

}

} else {

fm_set_msg(lng('Invalid characters in file or folder name'), 'error');

}

fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH));

}

if (isset($_GET['copy'], $_GET['finish']) && !FM_READONLY) {

// from

$copy = $_GET['copy'];

$copy = fm_clean_path($copy);

// empty path

if ($copy == '') {

fm_set_msg(lng('Source path not defined'), 'error');

fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH));

}

// abs path from

$from = FM_ROOT_PATH . '/' . $copy;

// abs path to

$dest = FM_ROOT_PATH;

if (FM_PATH != '') {

$dest .= '/' . FM_PATH;

}

$dest .= '/' . basename($from);

// move?

$move = isset($_GET['move']);

// copy/move/duplicate

if ($from != $dest) {

$msg_from = trim(FM_PATH . '/' . basename($from), '/');

if ($move) { // Move and to != from so just perform move

$rename = fm_rename($from, $dest);

if ($rename) {

fm_set_msg(sprintf(lng('Moved from').' <b>%s</b> '.lng('to').' <b>%s</b>', fm_enc($copy), fm_enc($msg_from)));

} elseif ($rename === null) {

fm_set_msg(lng('File or folder with this path already exists'), 'alert');

} else {

fm_set_msg(sprintf(lng('Error while moving from').' <b>%s</b> '.lng('to').' <b>%s</b>', fm_enc($copy), fm_enc($msg_from)), 'error');

}

} else { // Not move and to != from so copy with original name

if (fm_rcopy($from, $dest)) {

fm_set_msg(sprintf(lng('Copied from').' <b>%s</b> '.lng('to').' <b>%s</b>', fm_enc($copy), fm_enc($msg_from)));

} else {

fm_set_msg(sprintf(lng('Error while copying from').' <b>%s</b> '.lng('to').' <b>%s</b>', fm_enc($copy), fm_enc($msg_from)), 'error');

}

}

} else {

if (!$move){ //Not move and to = from so duplicate

$msg_from = trim(FM_PATH . '/' . basename($from), '/');

$fn_parts = pathinfo($from);

$extension_suffix = '';

if(!is_dir($from)){

$extension_suffix = '.'.$fn_parts['extension'];

}

//Create new name for duplicate

$fn_duplicate = $fn_parts['dirname'].'/'.$fn_parts['filename'].'-'.date('YmdHis').$extension_suffix;

$loop_count = 0;

$max_loop = 1000;

// Check if a file with the duplicate name already exists, if so, make new name (edge case...)

while(file_exists($fn_duplicate) & $loop_count < $max_loop){

$fn_parts = pathinfo($fn_duplicate);

$fn_duplicate = $fn_parts['dirname'].'/'.$fn_parts['filename'].'-copy'.$extension_suffix;

$loop_count++;

}

if (fm_rcopy($from, $fn_duplicate, False)) {

fm_set_msg(sprintf('Copyied from <b>%s</b> to <b>%s</b>', fm_enc($copy), fm_enc($fn_duplicate)));

} else {

fm_set_msg(sprintf('Error while copying from <b>%s</b> to <b>%s</b>', fm_enc($copy), fm_enc($fn_duplicate)), 'error');

}

}

else{

fm_set_msg(lng('Paths must be not equal'), 'alert');

}

}

fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH));

}

if (isset($_POST['file'], $_POST['copy_to'], $_POST['finish']) && !FM_READONLY) {

// from

$path = FM_ROOT_PATH;

if (FM_PATH != '') {

$path .= '/' . FM_PATH;

}

// to

$copy_to_path = FM_ROOT_PATH;

$copy_to = fm_clean_path($_POST['copy_to']);

if ($copy_to != '') {

$copy_to_path .= '/' . $copy_to;

}

if ($path == $copy_to_path) {

fm_set_msg(lng('Paths must be not equal'), 'alert');

fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH));

}

if (!is_dir($copy_to_path)) {

if (!fm_mkdir($copy_to_path, true)) {

fm_set_msg('Unable to create destination folder', 'error');

fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH));

}

}

// move?

$move = isset($_POST['move']);

// copy/move

$errors = 0;

$files = $_POST['file'];

if (is_array($files) && count($files)) {

foreach ($files as $f) {

if ($f != '') {

// abs path from

$from = $path . '/' . $f;

// abs path to

$dest = $copy_to_path . '/' . $f;

// do

if ($move) {

$rename = fm_rename($from, $dest);

if ($rename === false) {

$errors++;

}

} else {

if (!fm_rcopy($from, $dest)) {

$errors++;

}

}

}

}

if ($errors == 0) {

$msg = $move ? 'Selected files and folders moved' : 'Selected files and folders copied';

fm_set_msg($msg);

} else {

$msg = $move ? 'Error while moving items' : 'Error while copying items';

fm_set_msg($msg, 'error');

}

} else {

fm_set_msg(lng('Nothing selected'), 'alert');

}

fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH));

}

if (isset($_GET['ren'], $_GET['to']) && !FM_READONLY) {

// old name

$old = $_GET['ren'];

$old = fm_clean_path($old);

$old = str_replace('/', '', $old);

// new name

$new = $_GET['to'];

$new = fm_clean_path(strip_tags($new));

$new = str_replace('/', '', $new);

// path

$path = FM_ROOT_PATH;

if (FM_PATH != '') {

$path .= '/' . FM_PATH;

}

// rename

if (fm_isvalid_filename($new) && $old != '' && $new != '') {

if (fm_rename($path . '/' . $old, $path . '/' . $new)) {

fm_set_msg(sprintf(lng('Renamed from').' <b>%s</b> '. lng('to').' <b>%s</b>', fm_enc($old), fm_enc($new)));

} else {

fm_set_msg(sprintf(lng('Error while renaming from').' <b>%s</b> '. lng('to').' <b>%s</b>', fm_enc($old), fm_enc($new)), 'error');

}

} else {

fm_set_msg(lng('Invalid characters in file name'), 'error');

}

fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH));

}

if (isset($_GET['dl'])) {

$dl = $_GET['dl'];

$dl = fm_clean_path($dl);

$dl = str_replace('/', '', $dl);

$path = FM_ROOT_PATH;

if (FM_PATH != '') {

$path .= '/' . FM_PATH;

}

if ($dl != '' && is_file($path . '/' . $dl)) {

fm_download_file($path . '/' . $dl, $dl, 1024);

exit;

} else {

fm_set_msg(lng('File not found'), 'error');

fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH));

}

}

if (!empty($_FILES) && !FM_READONLY) {

$override_file_name = false;

$f = $_FILES;

$path = FM_ROOT_PATH;

$ds = DIRECTORY_SEPARATOR;

if (FM_PATH != '') {

$path .= '/' . FM_PATH;

}

$errors = 0;

$uploads = 0;

$allowed = (FM_UPLOAD_EXTENSION) ? explode(',', FM_UPLOAD_EXTENSION) : false;

$response = array (

'status' => 'error',

'info' => 'Oops! Try again'

);

$filename = $f['file']['name'];

$tmp_name = $f['file']['tmp_name'];

$ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));

$isFileAllowed = ($allowed) ? in_array($ext, $allowed) : true;

if(!fm_isvalid_filename($filename) && !fm_isvalid_filename($_REQUEST['fullpath'])) {

$response = array (

'status' => 'error',

'info' => "Invalid File name!",

);

echo json_encode($response); exit();

}

$targetPath = $path . $ds;

if ( is_writable($targetPath) ) {

$fullPath = $path . '/' . $_REQUEST['fullpath'];

$folder = substr($fullPath, 0, strrpos($fullPath, "/"));

if(file_exists ($fullPath) && !$override_file_name) {

$ext_1 = $ext ? '.'.$ext : '';

$fullPath = str_replace($ext_1, '', $fullPath) .'_'. date('ymdHis'). $ext_1;

}

if (!is_dir($folder)) {

$old = umask(0);

mkdir($folder, 0777, true);

umask($old);

}

if (empty($f['file']['error']) && !empty($tmp_name) && $tmp_name != 'none' && $isFileAllowed) {

if (move_uploaded_file($tmp_name, $fullPath)) {

// Be sure that the file has been uploaded

if ( file_exists($fullPath) ) {

$response = array (

'status' => 'success',

'info' => "file upload successful"

);

} else {

$response = array (

'status' => 'error',

'info' => 'Couldn\'t upload the requested file.'

);

}

} else {

$response = array (

'status' => 'error',

'info' => "Error while uploading files. Uploaded files $uploads",

);

}

}

} else {

$response = array (

'status' => 'error',

'info' => 'The specified folder for upload isn\'t writeable.'

);

}

// Return the response

echo json_encode($response);

exit();

}

if (isset($_POST['group'], $_POST['delete']) && !FM_READONLY) {

$path = FM_ROOT_PATH;

if (FM_PATH != '') {

$path .= '/' . FM_PATH;

}

$errors = 0;

$files = $_POST['file'];

if (is_array($files) && count($files)) {

foreach ($files as $f) {

if ($f != '') {

$new_path = $path . '/' . $f;

if (!fm_rdelete($new_path)) {

$errors++;

}

}

}

if ($errors == 0) {

fm_set_msg(lng('Selected files and folder deleted'));

} else {

fm_set_msg(lng('Error while deleting items'), 'error');

}

} else {

fm_set_msg(lng('Nothing selected'), 'alert');

}

fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH));

}

if (isset($_POST['group']) && (isset($_POST['zip']) || isset($_POST['tar'])) && !FM_READONLY) {

$path = FM_ROOT_PATH;

$ext = 'zip';

if (FM_PATH != '') {

$path .= '/' . FM_PATH;

}

//set pack type

$ext = isset($_POST['tar']) ? 'tar' : 'zip';

if (($ext == "zip" && !class_exists('ZipArchive')) || ($ext == "tar" && !class_exists('PharData'))) {

fm_set_msg(lng('Operations with archives are not available'), 'error');

fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH));

}

$files = $_POST['file'];

if (!empty($files)) {

chdir($path);

if (count($files) == 1) {

$one_file = reset($files);

$one_file = basename($one_file);

$zipname = $one_file . '_' . date('ymd_His') . '.'.$ext;

} else {

$zipname = 'archive_' . date('ymd_His') . '.'.$ext;

}

if($ext == 'zip') {

$zipper = new FM_Zipper();

$res = $zipper->create($zipname, $files);

} elseif ($ext == 'tar') {

$tar = new FM_Zipper_Tar();

$res = $tar->create($zipname, $files);

}

if ($res) {

fm_set_msg(sprintf(lng('Archive').' <b>%s</b> '.lng('Created'), fm_enc($zipname)));

} else {

fm_set_msg(lng('Archive not created'), 'error');

}

} else {

fm_set_msg(lng('Nothing selected'), 'alert');

}

fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH));

}

if (isset($_GET['unzip']) && !FM_READONLY) {

$unzip = $_GET['unzip'];

$unzip = fm_clean_path($unzip);

$unzip = str_replace('/', '', $unzip);

$isValid = false;

$path = FM_ROOT_PATH;

if (FM_PATH != '') {

$path .= '/' . FM_PATH;

}

if ($unzip != '' && is_file($path . '/' . $unzip)) {

$zip_path = $path . '/' . $unzip;

$ext = pathinfo($zip_path, PATHINFO_EXTENSION);

$isValid = true;

} else {

fm_set_msg(lng('File not found'), 'error');

}

if (($ext == "zip" && !class_exists('ZipArchive')) || ($ext == "tar" && !class_exists('PharData'))) {

fm_set_msg(lng('Operations with archives are not available'), 'error');

fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH));

}

if ($isValid) {

//to folder

$tofolder = '';

if (isset($_GET['tofolder'])) {

$tofolder = pathinfo($zip_path, PATHINFO_FILENAME);

if (fm_mkdir($path . '/' . $tofolder, true)) {

$path .= '/' . $tofolder;

}

}

if($ext == "zip") {

$zipper = new FM_Zipper();

$res = $zipper->unzip($zip_path, $path);

} elseif ($ext == "tar") {

try {

$gzipper = new PharData($zip_path);

if (@$gzipper->extractTo($path,null, true)) {

$res = true;

} else {

$res = false;